Security audit

Self Improving Agent.Tmp

Security checks for vulnerabilities and agentic risk

Overview

This skill appears intended for self-improvement logging, but it can persist user and agent context into future sessions and broad agent instruction files without enough safeguards.

Review before installing. Prefer project-scoped hooks over global user-level hooks, avoid empty matchers unless you want every prompt affected, and require explicit review before writing to CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions. Do not store secrets, personal data, raw transcripts, or raw tool output in .learnings, and avoid sessions_history or sessions_send unless the user has approved the specific source and destination.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:15
Finding: Untrusted conversational content can be promoted into persistent agent instruction files## Vulnerability Details **File Location**: `SKILL.md:15-26`, `SKILL.md:262-289`, `SKILL.md:440-448`; related workflow in `references/openclaw-integration.md:73-124` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: High ### Vulnerable Code or Instructions ```markdown | User corrects you | Log to `.learnings/LEARNINGS.md` with category `correction` | | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) | ``` ```markdown ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md` ``` ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` ### Technical Analysis The workflow treats user corrections, task observations, and error context as candidate learning material and permits that material to be promoted into persistent instruction files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, and `.github/copilot-instructions.md`. These files are not ordinary audit logs. They are described as workspace prompt files that are injected into later agent sessions. The promotion process does not require explicit owner approval, provenance checks, separation of data from instructions, or sanitization of imperative content. Consequently, an attacker-controlled “correction” can be transformed into a durable agent rule. The risk is amplified by the instruction to “promote aggressively,” which lowers the threshold for writ ...[truncated 1387 chars]
Remediation: ## Remediation Suggestions 1. Never automatically promote conversational content into agent instruction files. 2. Require explicit, informed user approval for each target file and display the exact proposed diff before writing. 3. Store learnings in a dedicated data-only location that is not automatically interpreted as agent instructions. 4. Add provenance fields identifying the originating session, user, and approval status. 5. Reject or quarantine learning entries containing imperative instructions, tool commands, requests to override prior rules, or references to secrets. 6. Use a strict allowlist of factual fields that may be promoted, rather than free-form text. 7. Remove the “promote aggressively” instruction and require recurrence, independent verification, and maintainer review. 8. Provide rollback support and an audit trail for all modifications to persistent prompt files.

T01 · Skill Instruction Hijacking

Warning

Location: scripts/activator.sh:9
Finding: Hooks inject skill-controlled instructions into every prompt or agent bootstrap## Vulnerability Details **File Location**: `scripts/activator.sh:9-18`, `hooks/openclaw/handler.js:8-48`, `hooks/openclaw/handler.ts:10-59` **Vulnerability Type**: Global prompt and bootstrap instruction injection **Risk Level**: Medium ### Vulnerable Code ```bash # Output reminder as system context cat << 'EOF' <self-improvement-reminder> After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern learned? - Error required debugging to resolve? If yes: Log to .learnings/ using the self-improvement skill format. If high-value (recurring, broadly applicable): Consider skill extraction. </self-improvement-reminder> EOF ``` ```javascript const REMINDER_CONTENT = ` ## Self-Improvement Reminder After completing tasks, evaluate if any learnings should be captured: **Log when:** - User corrects you → \`.learnings/LEARNINGS.md\` - Command/operation fails → \`.learnings/ERRORS.md\` - User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\` - You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\` - You find a better approach → \`.learnings/LEARNINGS.md\` **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` Keep entries simple: date, title, what happened, what to do differently. `.trim(); if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } ``` ### Technical Analysis The prompt-submit hook emits instructions explicitly described as “system context.” The OpenClaw handler similarly inserts a virtual bootstrap file into `event.context.bootstrapFiles`. Once the optional hooks are enabled ...[truncated 1700 chars]
Remediation: ## Remediation Suggestions 1. Do not present hook output as system context. 2. Replace global instruction injection with a user-visible, non-authoritative notification. 3. Activate learning capture only through an explicit user command or narrowly scoped task matcher. 4. Require confirmation before any file creation, append, promotion, or skill extraction. 5. Separate reminder text from trusted bootstrap files so it cannot be interpreted at the same trust level as workspace policy. 6. Disable user-level global installation by default and clearly disclose the full behavioral scope before activation. 7. Add tests confirming that unrelated prompts do not trigger learning writes or persistent context changes.

other

Warning

Location: references/openclaw-integration.md:159
Finding: Workflow encourages reading and propagating data from unrelated sessions## Vulnerability Details **File Location**: `SKILL.md:87-92`, `references/openclaw-integration.md:159-186` **Vulnerability Type**: Cross-session transcript access and information propagation **Risk Level**: Medium ### Vulnerable Instructions ```markdown OpenClaw provides tools to share learnings across sessions: - **sessions_list** — View active/recent sessions - **sessions_history** — Read another session's transcript - **sessions_send** — Send a learning to another session - **sessions_spawn** — Spawn a sub-agent for background work ``` ```markdown ### sessions_history Read transcript from another session: ``` sessions_history(sessionKey="session-id", limit=50) ``` ### sessions_send Send message to another session: ``` sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header") ``` ``` ### Technical Analysis The skill advertises transcript reading and cross-session messaging as part of its learning workflow, although local learning capture does not require access to unrelated sessions. No consent requirement, session allowlist, data classification, secret redaction, or trust-boundary guidance is provided. Session transcripts can contain private user information, credentials printed during debugging, proprietary code, or adversarial instructions. Copying transcript-derived material into `.learnings/` or prompt files can create both confidentiality exposure and persistent prompt poisoning. The audited project does not itself invoke these tools automatically. The risk arises from the documented agent behavior and the unnecessary expansion of the workflow’s data-access scope. ### Attack Path 1. The agent follows the documented inter-session workflow and lists active or recent sessions. 2. It reads a transcript from another session using `sessions_history`. 3. The transcript contains sensitive information or attacker-authored instructions. 4. The agent classifi ...[truncated 789 chars]
Remediation: ## Remediation Suggestions 1. Remove `sessions_history` from the default learning workflow. 2. Require explicit user authorization naming the source session and intended destination before transcript access. 3. Limit access through session allowlists and least-privilege tool policies. 4. Redact credentials, tokens, personal information, and proprietary content before storage or forwarding. 5. Treat all transcript content as untrusted data and prohibit direct promotion into instruction files. 6. Record provenance and consent metadata for any cross-session learning. 7. Prefer user-authored summaries over direct transcript retrieval.

T09 · Insecure Skill Coding Practices

Note

Location: hooks/openclaw/handler.ts:39
Finding: JavaScript runtime handler omits the sub-agent exclusion implemented in TypeScript## Vulnerability Details **File Location**: `hooks/openclaw/handler.ts:39-43`; corresponding guard is absent from `hooks/openclaw/handler.js:27-49` **Vulnerability Type**: Security-relevant source and runtime divergence **Risk Level**: Low ### Divergent Code The TypeScript source contains this exclusion: ```typescript // Skip sub-agent sessions to avoid bootstrap issues // Sub-agents have sessionKey patterns like "agent:main:subagent:..." const sessionKey = event.sessionKey || ''; if (sessionKey.includes(':subagent:')) { return; } ``` The shipped JavaScript proceeds directly from context validation to injection: ```javascript // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } ``` ### Technical Analysis The JavaScript and TypeScript implementations are not behaviorally equivalent. TypeScript excludes session keys containing `:subagent:`, while JavaScript injects the reminder into any valid `agent:bootstrap` event with a `bootstrapFiles` array. If the platform executes `handler.js`, reviewers relying on `handler.ts` may incorrectly conclude that sub-agents are excluded. This is a security-relevant build and release integrity issue because it broadens the scope of instruction injection. ### Attack Path 1. The OpenClaw installation loads `handler.js` as the runtime entry point. 2. A sub-agent receives an `agent:bootstrap` event. 3. The JavaScript handler validates the event and context. 4. Because the sub-agent guard is absent, it appends `SELF_IMPROVEMENT_REMINDER.md`. 5. The sub-agent receives instructions that the TypeScript source appear ...[truncated 492 chars]
Remediation: ## Remediation Suggestions 1. Maintain one authoritative source implementation. 2. Generate JavaScript from TypeScript through a reproducible build rather than editing both files independently. 3. Add parity tests that execute both handlers against main-agent and sub-agent bootstrap events. 4. Add the sub-agent exclusion to the shipped JavaScript immediately if JavaScript remains a supported entry point. 5. Declare the runtime entry file explicitly in hook metadata or installation documentation. 6. Fail the release process when generated JavaScript differs from the compiled TypeScript output.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says this skill is for recording and reviewing learnings, corrections, failures, and outdated knowledge to enable continuous improvement. The supplied code does not implement that behavior. Instead, it is a project scaffolding utility that creates a new skill folder and a templated SKILL.md file from a skill name. While it mentions 'learning entry' in comments and template text, it does not capture, persist, review, or analyze learnings/errors/corrections as described. Its primary purpose is materially different: skill extraction/scaffold generation, including filesystem writes, argument parsing, and path validation.

Agent Config Directory Access

High

Category: Agent Snooping
Content: ### Option 2: User-Level Configuration Add to `~/.claude/settings.json` for global activation: ```json {
Confidence: 90% confidence
Finding: Directing users to modify ~/.claude/settings.json touches a sensitive agent configuration directory that controls persistent behavior. In the context of shell-command hooks, changing this file can establish durable code execution across future sessions, making it a high-risk persistence mechanism if misused or later altered.

Exfiltration Commands

High

Category: Prompt Injection
Content: ### sessions_send Send message to another session: ``` sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header") ```
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The skill description and early guidance are broad enough that an agent may invoke it in many ordinary situations, causing unnecessary writes to persistent memory files. In an agent environment with automatic skill loading or hooks, over-triggering increases the chance of recording sensitive or irrelevant conversation data without clear user intent.

Session Persistence

Medium

Category: Rogue Agent
Content: └── FEATURE_REQUESTS.md ``` ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Confidence: 84% confidence
Finding: The skill directs creation of persistent workspace storage under ~/.openclaw/workspace/.learnings, which establishes session-to-session memory outside the immediate task. Persistence is not inherently malicious, but in this context it increases privacy risk because other parts of the skill encourage broad logging and later review/sharing of that retained data.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill explicitly supports inter-session sharing of learnings and reading other session history, but it does not define data-minimization, consent, or redaction requirements. In practice, this can propagate sensitive conversation content across sessions and broaden access beyond the original task context.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The logging format instructs the agent to store full context, inputs, parameters, and user context in persistent markdown files. Those fields can easily capture secrets, personal data, internal paths, access tokens, or sensitive business information, creating a durable data-retention risk that may later be indexed, synced, or exposed.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The promotion workflow encourages copying learnings into long-lived agent context files such as CLAUDE.md, AGENTS.md, SOUL.md, and Copilot instructions. If a learning contains user-derived sensitive information, promotion turns a localized retention issue into broad and repeated propagation across future sessions and agents.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The automatic logging triggers rely on very common conversational phrases like corrections and feature wishes, which can be encountered in normal chat and may cause routine user statements to be persisted. That creates a privacy and integrity risk because the agent may over-collect user-provided content and treat transient discussion as durable memory.

Skill Enumeration

Medium

Category: Agent Snooping
Content: When the above learning is extracted as a skill, it becomes: **File**: `skills/docker-m1-fixes/SKILL.md` ```markdown ---
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

Category: Rogue Agent
Content: ### Option 1: Project-Level Configuration Create `.claude/settings.json` in your project root: ```json {
Confidence: 83% confidence
Finding: The guide instructs users to add persistent hook configuration to .claude/settings.json, which survives across sessions and continuously alters agent behavior. Persistence is especially relevant here because the hooks execute shell scripts, so the effect is not just instructional but operational and recurring.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: An empty matcher causes the hook to fire on every prompt, creating an always-on execution path for the referenced shell script. In a self-improvement skill, that broad trigger increases the blast radius of any script bug, prompt-context leakage, or later tampering with the script file.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The guidance recommends putting hook configuration in ~/.claude/settings.json for global activation without strong restrictions, which enables command-hook execution across all sessions and repositories. That persistence and scope make any unsafe script behavior, path hijack, or later file modification substantially more dangerous.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The Codex configuration repeats the empty matcher pattern, causing the command hook to run for every prompt. This broad trigger unnecessarily increases exposure to command execution and context processing in all interactions instead of only relevant error/debug workflows.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The document's security section claims the scripts only output text and do not run commands, yet the setup explicitly configures them as command hooks executed by the agent. This contradiction can mislead users into underestimating execution risk, causing them to install and trust shell-based hooks with the agent's privileges.

Session Persistence

Medium

Category: Rogue Agent
Content: openclaw hooks enable self-improvement ``` ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Confidence: 88% confidence
Finding: Creating a persistent `.learnings/` directory is not inherently unsafe, but in a self-improvement skill it establishes a mechanism for retaining potentially sensitive operational history across sessions. Without retention limits, access controls, or guidance on safe content, this persistence can accumulate secrets, user data, or internal context that later sessions or users may access.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation directs users to log learnings to persistent workspace files and promote them into shared context files without any guidance to avoid secrets, personal data, or sensitive prompts. In a self-improvement skill, failures and corrections often contain API errors, credentials-adjacent details, internal file paths, or user content, so persisting them can create unintended long-term data retention and secondary disclosure risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The cross-session features are presented as normal workflow tools, including reading transcript history and sending messages, but the documentation does not warn that these actions can expose sensitive context across sessions. In this skill's context, learnings may include errors, tool outputs, or user corrections, so cross-session sharing increases the attack surface for inadvertent disclosure or prompt-context leakage.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The usage text and overall flow show this file is meant to create a new skill from a learning entry, including directory creation and template generation. Creating new skills is not an obvious requirement of a skill whose declared purpose is to capture learnings, errors, and corrections for continuous improvement.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The manifest describes a skill focused on recording learnings, errors, corrections, and reviewing them before major tasks. This helper instead scaffolds an entirely new skill directory and writes a new SKILL.md file, which is a separate code-generation/project-creation capability rather than simply capturing or reviewing learning entries.

Static analysis

No suspicious patterns detected.